However, unlike [1]}, where authors studied possible attacks to recover the original data based on the output of full layers, we trained various networks when having only few feature maps of the intermediate data. The black-box attack is performed in three steps: (1) collect the training set of the inverse network by participating in the inference process: \((f^i_{\theta }(x_1),f^i_{\theta }(x_2),...,f^i_{\theta }(x_n))\) ; (2) train the network; and (3) recover the original image \(x\)  by inputting \(in\)  received from a previous participant. Note that the quality of the inversion is higher when the adversary has access to the original training dataset or the distribution of the samples as done in this work. Still, it is also possible to recover the data by assuming that the images have standard Gaussian distribution, as shown in [1]}.
<FIGURE>